Summary
Togoder Security scanned the npm package jsx-ast-utils@3.3.5 on Oct 6, 2026. An AI review of 84 source files produced 1 low severity finding. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.
0
critical
0
high
0
medium
1
low
Findings 1
low
debug logging
NPS-CF9EC07B06BB
A console.log statement exists in getValue that logs the value type if it is not found in the TYPES map. This is not malicious but could leak AST type information to console during use.
lib/values/index.js:52
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| elementType.js | safe | Cleared by Jev triage; no further analysis needed |
| eventHandlers.js | safe | Cleared by Jev triage; no further analysis needed |
| eventHandlersByType.js | safe | Cleared by Jev triage; no further analysis needed |
| getLiteralPropValue.js | safe | Cleared by Jev triage; no further analysis needed |
| getProp.js | safe | Cleared by Jev triage; no further analysis needed |
| getPropValue.js | safe | Cleared by Jev triage; no further analysis needed |
| hasAnyProp.js | safe | Cleared by Jev triage; no further analysis needed |
| hasEveryProp.js | safe | Cleared by Jev triage; no further analysis needed |
| hasProp.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/elementType.js | safe | No malicious patterns detected |
| lib/eventHandlers.js | safe | No malicious patterns detected |
| lib/getProp.js | safe | No malicious patterns detected; the code is a benign utility for finding JSX props in AST nodes with no network, file system, process, or dynamic code execution activity. |
| lib/getPropValue.js | safe | No malicious patterns detected; the code is a standard utility for extracting JSX attribute values from AST nodes. |
| lib/hasProp.js | safe | No malicious patterns detected; the code is a straightforward utility for checking JSX props and performs no network, filesystem, process, or dynamic code execution operations. |
| lib/index.js | safe | No malicious patterns detected |
| lib/propName.js | safe | No malicious patterns detected |
| lib/values/JSXElement.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/values/JSXFragment.js | safe | The code is a simple value extractor for JSX fragments with no malicious patterns such as data exfiltration, code execution, or network activity. |
| lib/values/JSXText.js | safe | No malicious patterns detected |
| lib/values/Literal.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/values/expressions/ArrayExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/values/expressions/AssignmentExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/values/expressions/BinaryExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/values/expressions/BindExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/values/expressions/CallExpression.js | safe | No malicious patterns detected; the code is a legitimate AST value extractor for CallExpression nodes with no network, filesystem, process, or dynamic execution behavior. |
Show 59 more files
| File | Verdict | What the reviewer saw |
|---|---|---|
| lib/values/expressions/ChainExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/values/expressions/ConditionalExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/values/expressions/FunctionExpression.js | safe | No malicious patterns detected; the code is a simple AST value extractor that returns a closure without executing external code or accessing sensitive resources. |
| lib/values/expressions/Identifier.js | safe | No malicious patterns detected; the code simply extracts AST identifier values with no network, filesystem, process, or dynamic execution activity. |
| lib/values/expressions/LogicalExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/values/expressions/MemberExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/values/expressions/NewExpression.js | safe | No malicious patterns detected; the module simply returns an empty object for NewExpression AST nodes. |
| lib/values/expressions/ObjectExpression.js | safe | No malicious patterns detected; the file is a standard AST utility for extracting values from object expressions. |
| lib/values/expressions/OptionalCallExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/values/expressions/OptionalMemberExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/values/expressions/SequenceExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/values/expressions/SpreadElement.js | safe | No malicious patterns detected; the file is a simple AST helper that returns undefined for SpreadElement nodes. |
| lib/values/expressions/TSNonNullExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/values/expressions/TaggedTemplateExpression.js | safe | No malicious patterns detected; the code is a simple utility that delegates to TemplateLiteral for extracting tagged template expression values. |
| lib/values/expressions/TemplateLiteral.js | safe | No malicious patterns detected; the code is a pure AST utility for template literals with no network, filesystem, process, or dynamic code execution behavior. |
| lib/values/expressions/ThisExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/values/expressions/TypeCastExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/values/expressions/UnaryExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/values/expressions/UpdateExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/values/expressions/index.js | safe | No malicious patterns detected |
| lib/values/index.js | safe | No malicious patterns detected; the code is a standard AST value extractor with only a minor debug logging concern. |
| propName.js | safe | Cleared by Jev triage; no further analysis needed |
| src/elementType.js | safe | Cleared by Jev triage; no further analysis needed |
| src/eventHandlers.js | safe | No malicious patterns detected |
| src/getProp.js | safe | Cleared by Jev triage; no further analysis needed |
| src/getPropValue.js | safe | Cleared by Jev triage; no further analysis needed |
| src/hasProp.js | safe | Cleared by Jev triage; no further analysis needed |
| src/index.js | safe | Cleared by Jev triage; no further analysis needed |
| src/propName.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/JSXElement.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/JSXFragment.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/JSXText.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/Literal.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/ArrayExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/AssignmentExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/BinaryExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/BindExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/CallExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/ChainExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/ConditionalExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/FunctionExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/Identifier.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/LogicalExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/MemberExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/NewExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/ObjectExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/OptionalCallExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/OptionalMemberExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/SequenceExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/SpreadElement.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/TSNonNullExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/TaggedTemplateExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/TemplateLiteral.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/ThisExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/TypeCastExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/UnaryExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/UpdateExpression.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/expressions/index.js | safe | Cleared by Jev triage; no further analysis needed |
| src/values/index.js | safe | Cleared by Jev triage; no further analysis needed |
Frequently asked questions
Is jsx-ast-utils safe to use?
Our AI source review of jsx-ast-utils@3.3.5 found no malicious code: no install-time payloads, credential theft, exfiltration, obfuscated loaders or backdoors.
Does jsx-ast-utils contain malware?
No malware was identified in jsx-ast-utils@3.3.5 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was jsx-ast-utils checked?
Togoder Security downloaded the published npm package and had an AI model read its 84 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan jsx-ast-utils together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in jsx-ast-utils@3.3.5, cost nothing.